LOCAL SOC & DETECTION ENGINEERING LAB · 1.0.0

SOCWERK

A compact analyst workspace that carries synthetic incidents from raw telemetry through explainable detections, evidence correlation, incident decisions, and professional reports.

SOURCE QUICK START

SVELTEKIT
FASTAPI
SQLITE
MITRE ATT&CK
DOCKER COMPOSE
EN · DE

INVESTIGATION WORKFLOW

FROM TELEMETRY TO DECISION

01INGESTRAW SECURITY TELEMETRY
02NORMALIZECONSISTENT EVENT MODEL
03DETECTFIELD-LEVEL MATCHES
04TRIAGECONTROLLED ALERT STATE
05CORRELATEENTITIES · TIME · ANCESTRY
06DECIDEFINDING · INCIDENT
07CONTAINSIMULATED ACTIONS
08REPORTMARKDOWN · JSON · HTML

ANALYST WORKSPACE

EVIDENCE BEFORE VERDICT

SOCWerk / CONVERGING SIGNALS

ADVANCED · 30–45 MIN

EVENT EXPLORERsource = sysmon and severity = high192 EVENTS

SELECTED EVENT

Command interpreter started PowerShell with encoded arguments

HIGH · MATCHED

cmd.exe → powershell.exe · usr-fin-610 · asset-ws-610

CONDITION 01: process_name equals powershell.exe
CONDITION 02: attributes.execution_style equals encoded

DETECTION MATCH

IMPLEMENTED SURFACE

AN INVESTIGATION, NOT A QUIZ

EXPLAINABLE DETECTIONS

Every match exposes the field, operator, expected value, and observed value that produced the alert.

PERSISTENT ANALYST STATE

Evidence, notes, hypotheses, findings, alert decisions, and incident decisions remain in SQLite.

PROTECTED ASSESSMENT

Expected outcomes stay on the backend until submission, followed by deterministic learning feedback.

BOUNDED QUERYING

A small read-only query language filters in-memory events without passing scenario input to SQL or an evaluator.

SCENARIO DOSSIER

CONVERGING SIGNALS

The advanced SOCWerk-native investigation asks the analyst to reconstruct a multi-stage compromise while separating hostile behavior from credible administrative and business lookalikes.

EVENTS: 192
ALERTS: 18
DETECTIONS: 14
LEVEL: ADVANCED

TELEMETRY IN VIEW

EMAIL · OFFICE · SYSMON · POWERSHELL · WINDOWS SECURITY · VPN / MFA · DNS · PROXY · ENDPOINT · ZEEK

INCLUDED INVESTIGATIONS

01SUSPICIOUS LOGIN ACTIVITYIDENTITY · MFA · VPN
02PHISHING INVESTIGATIONEMAIL · BROWSER · ENDPOINT
03SUSPICIOUS POWERSHELLPROCESS · SCRIPT BLOCK · PROXY
04SUSPICIOUS FILE TRANSFERFILE · DNS · DLP

SYSTEM SHAPE

SMALL, LOCAL, EXPLICIT

ANALYST INTERFACESVELTEKITJSON / HTTP

DOMAIN / APIFASTAPIQUERY · DETECTION · CORRELATION

IMMUTABLE FACTSSCENARIO JSONREAD ONLY

ANALYST STATESQLITEEVIDENCE · DECISIONS

TRUST BOUNDARIES

DEFENSIVE BY CONSTRUCTION

01
The lab does not scan networks, send phishing, generate payloads, execute scenario commands, or contact targets.
02
All identities, domains, addresses, files, and infrastructure are synthetic; network indicators use reserved ranges and .example domains.
03
Scenario packs are strict versioned JSON. They cannot load code or remote content, and their expected outcomes remain server-side before submission.
04
Containment is a documented analyst decision only. It never performs an action against an external system.